II. 1 Quality risk management as part of

1
II. 1 Quality risk management as part of

• Integrated Quality Management

Industry
Competent Authorities
2
Quality risk management as part of

• II.1 Integrated quality management
• Documentation
• Training and education
• Quality defects
• Auditing / Inspection
• Periodic review
• Change management / change control
• Continual improvement

3
II.1 QRM as Part of integrated Quality Management

• Documentation
• To review current interpretations and application
  of regulatory expectations
• To determine the desirability of and/or develop
  the content for SOPs, guidelines, etc.

ICH Q9
4
Existing document structure
5
Include ICH Q9
Risk-based approach
Consider ICH Q9
Implementrisk-based thinking
e.g. FMEA tablelist of residual risks
Examples for using specific tools
6
Application of documentation system

• A topic for any quality management system might
  be arisk-based approach for decision making
• Include consideration of ICH Q9 guideline in the
  directive on Quality Unit-activities as a
  requirement
• During periodic review of regulations, policies,
  guidelines and standard operating procedures
  (SOP) etc. think about implementing the ICH Q9
  principles
• Share examples of specific tools and their useas
  a means of sharing best practice

7
II.1 QRM as Part of integrated Quality Management

• Training and education
• To determine the appropriateness of initial
  and/or ongoing training sessions
• Based on education, experience and working habits
• A periodic assessment of previous training
  (effectiveness)
• To identify the training, experience,
  qualifications and physical abilities
• To perform an operation reliably and with no
  adverse impact on the quality of the product

ICH Q9
8
II.1 QRM as Part of integrated Quality Management

• Quality defects
• To provide the basis for identifying,
  evaluating, and communicating the potential
  quality impact of a suspected quality defect,
  complaint, trend, deviation, investigation, out
  of specification result, etc.
• To facilitate risk communications
• To determine appropriate action to address
  significant product defects, in conjunction with
  regulatory authorities (e.g., recall)

ICH Q9
9
Assess the history of known quality defects

• Vision
• Robust Processes, non-recurrent Q-problems
• Target
• Continuous improvement to resolve known
  problemse.g. from CAPA, inspections/audits, non
  robust processes
• Preventatively work towards the achievement of a
  high reliability, productivity, quality of all
  that we do
• Manage dedicated projects to support site /
  departments / process / products

10
Assess the history of known quality defects
ICH Q9
Site approach
Identification of opportunities for improvement
Use risk assessment tool -risk analysis -risk
evaluation prioritization
Select improvement opportunities
Dedicated projects - Establish a team
Problem solving approach
Risk review re-application of risk assessment
tool
11
Assess the history of known quality defects

• Approach
• Increase the knowledge of weaknesses for all
  processes at the site and evaluate the related
  risks
• Tackle individual issues by problem solving
  methods e.g. root cause analysis, statistics,
  tools
• Tool
• Risk Assessment tools select dynamic tool to
  identify which are the most significant problems
  in order toallow identification of priorities
  (e.g. FTA, FMEA, etc.)
• SixSigma type Project approach for problem
  solving teams on each identified priority

12
Assess the history of known quality defects

• The project approach
• Teamwork (inter-departmental teams) possibly
  using a facilitator
• Select methodology
• Commit resources appropriate to the project,
  priority and size
• Problem solving structure
• Problem Finding Setting
• Problem Analysis
• Problem solution identification
• Sharing with management (communication)
• Decision making implementation

13
II.1 QRM as Part of integrated Quality Management

• Deviation / Investigation Report
• The event triggers a review of quality risk
  management decisions
• to control or accept risk related to a process
• to ensure these decisions are still valid based
  on the new learning
• In detail this could include
• Initiate Quality Risk Management process
• Product and process information
• Define the problem
• Detailed description of the discrepancy

14
Deviation/ Investigation Report

• Risk assessment Risk analysis
• Assessment of effects of the discrepancy
  Examples if applicable
• Product quality
• Drug safety
• Registration files / Marketing authorisation
• Systems in place
• Availability of goods potentially insufficient
  stock levels
• Identification of the root cause

15
Deviation/ Investigation Report

• Risk assessment Risk evaluation
• Consequences for other products / batches
• Systems failure
• Evaluation of
• Performed
• Foreseen actions
• Measurements

16
Deviation/ Investigation Report

• Risk Control Risk Reduction/ Mitigation
• Corrective actions to resolve the discrepancy
• Corrective actions to avoid a recurrence in the
  future
• Risk Control Risk Acceptance
• Conclusions of measures taken
• Decisions on disposition of the material
• Define Follow up actions (if applicable)
• Management summary (if applicable)
• Date and signature
• responsible manager
• approval of QU

17
Deviation/ Investigation Report

• Risk Communication
• Frequent interactions (e.g. short daily meeting)
• Informal meetings
• Scheduled regular meetings (minutes)

18
Deviation/ Investigation Report

• Risk Review
• Follow up of action items
• Summary and evaluation
• e.g. Annual Product Review

19
One page Deviation/ Investigation Report
20
Complaint/ Issue Management

• Initiate Quality Risk Management process
• Information on the complaint/ issue
• Product information
• Risk identification Define the problem
• Detailed description of the complaint/ issue
• Risk to patient? Recall needed?
• Risk communication to central coordination unit

21
Complaint/ Issue Management

• Risk assessment Risk analysis
• Assessment of effects of the discrepancy
  Examples if applicable
• Lot tracing
• Product quality
• Patient impact
• Registration/ Marketing authorisation
• Systems in place
• Availability of stock potentially insufficient
  stock levels..
• Identification of the root cause
• Risk communication to expert team

22
Complaint/ Issue Management

• Risk assessment Risk evaluation
• Consequences for other batches/ products
• Systems failure
• Evaluation of
• Available data
• Performed actions
• Foreseen actions
• Measurements
• Risk communication to central coordination
  unit involve management, if appropriate

23
Complaint/ Issue Management

• Risk Control Risk Reduction/ Mitigation
• Corrective actions to resolve the discrepancy
• Corrective actions to avoid a recurrence in the
  future
• Risk Control Risk Acceptance
• Conclusions of measures taken (management sign
  off)
• Decisions on disposition of the material
• Define follow up actions (if applicable)
• Management summary (if applicable)
• Date and signature of minutes
• Risk communication management to decide next
  steps

24
Complaint/ Issue Management

• Output/ result Risk Communication
• Internal
• Sites / Affiliates
• Informal meetings
• Address in regular meetings
• Training sessions
• External
• Communicate with Competent Authorities (e.g.
  Field Alert, incident summary)
• To whom it may concern letters
• Pharmacies

25
Complaint/ Issue Management

• Risk Review
• Follow up of action items
• Summary and evaluation e.g. Product Quality
  Review, Annual Product Review, follow-up report

26
II.1 QRM as Part of integrated Quality Management

• Auditing / Inspection
• To define the frequency and scope of audits
• Taking into account factors such as
• Existing legal requirements
• Overall compliance status and history of the
  company
• Robustness of a companys quality risk management
  activities
• Complexity of the site, manufacturing process,
  product and its therapeutic significance
• Compliance status and history
• Results of previous audits/inspections
• Number and significance of quality defects (e.g,
  recall)
• Results of previous audits/inspections
• Major changes of building, equipment, processes,
  key personnel
• Experience with manufacturing of a product (e.g.
  frequency, volume, number of batches)
• Test results of official control laboratories

ICH Q9
27
Inspections
Risk Communication Risk Review
Start
cGMP/Compliance Inspections
Risk Acceptance (Work Planning)
Risk Identification(Databases)
Risk Analysis Risk Evaluation(Multi-Factorial
Risk Model)
Risk Reduction(Risk Ranking and Filtering)
D.Horowitz, FDA April 2005
28
Scheduling audits A framework

• How industry might be able to set up a risk-based
  evaluation scheme to assess the need to audit.
• A similar approach could be used by competent
  authorities (CA) for scheduling inspections.
• 1. Brainstorm to create a list of manufacturers
  / traders to be audited
• 2. Evaluate all sources of audit reports from
  competent authorities, competent companies or
  third parties conducted according local and/or
  other GMP-standards (e.g. PIC/S, WHO respective
  VFA, APIC)

S. Rönninger EFPIA TG foreign inspections
Feb.06
29
Scheduling audits A framework

• 3. Evaluate risk factor according to criteria
  based on managing risk for patients, which can
  (easily) be evaluated and maintained
• Severity Compliance effects safety efficacy
• Severity Patient interest effects availability
• Probability Complexity Drug(medicinal)product,
  API etc.
• Detectability Audit History frequency of
  audit/inspections

S. Rönninger EFPIA TG foreign inspections
Feb.06
30
Scheduling audits A framework

• 4. Weighting on to protection of patient
• See list on following slides- In case of
  different activities take the highest ranking!-
  In case their is nothing known, take the highest
  ranking!

S. Rönninger EFPIA TG foreign inspections
Feb.06
31
Scheduling audits A framework

• Compliance (Severity)patient risk addressing
  safety efficacy

S. Rönninger EFPIA TG foreign inspections
Feb.06
32
Scheduling audits A framework

• Compliance (Severity)patient risk addressing
  availability

S. Rönninger EFPIA TG foreign inspections Feb.06
33
Scheduling audits A framework

• Complexity (Probability)

S. Rönninger EFPIA TG foreign inspections
Feb.06
34
Scheduling audits A framework

• History (Detectability)

S. Rönninger EFPIA TG foreign inspections
Feb.06
35
Scheduling audits A framework

• 5. Multiply the factors
• 6. Sort by overall risk factor
• 7. Announce audits on a predetermined figure
  e.g. 96

S. Rönninger EFPIA TG foreign inspections
Feb.06
36
Scheduling audits A framework

• Why 96? Conclude to schedule an audit when,
• Compliance/Severity Safety Efficacy medium
  (3) or more
• Compliance/Severity Availability       major
  (4) or more
• Complexity Probability                      
  indirect use for patient (2) or more
• History Detectability                          
  3 years ago (4) or more
• This would result in 3 x 4 x 2 x 4 96

EFPIA TG foreign inspections Feb.06
37
Scheduling audits

• Result an overview
• Updating once a year for planning

Weighted factors
Indication for priority
Do not trust in the values only
38
II.1 QRM as Part of integrated Quality Management

• Periodic review
• To select, evaluate and interpret trend results
  within the product quality review
• To interpret monitoring datae.g. to support an
  assessment of the need for revalidation, changes
  in sampling etc.

ICH Q9
39
II.1 QRM as Part of integrated Quality Management

• Change management / change control
• To manage changes based on knowledge and
  informationaccumulated in pharmaceutical
  development and during manufacturing
• To evaluate the impact of the changes on the
  availability of the final product
• To evaluate the impact on product quality of
  changes
• To determine appropriate actions preceding the
  implementation of a change

ICH Q9
40
Responsibilities in case of Change Control
Industry
Regulators
41
II.1 QRM as Part of integrated Quality Management

• Continual improvement
• To facilitate continual improvement in processes
  throughout the product lifecycle

ICH Q9
42
Continual Improvement
All red arrows are a part of Risk Communication
Takayoshi Matsumura, Eisai Co.